The Network Scanner App is a network scanning tool that offers port scanning, geolocation, and DHCP listening functionalities. As a security-focused tool, users must understand the importance of secure usage practices and follow best practices when deploying or interacting with the tool. 🛡️

The application uses common Python libraries such as scapy, paramiko, and ipinfo. It does not require elevated privileges, but careful attention to network security practices is needed in production environments. 🌐

If you find a security vulnerability or issue with the Network Scanner App, please report it to us via email or GitHub Issues. We take security seriously and will address any vulnerabilities as soon as possible. 🔍

1. Email: Please send a detailed report of the security issue to [mangesh@ameyacloud.com] 📧
2. GitHub Issues: You can create an issue on our repository's GitHub Issues page, marking it with the label security. 🐛

Please provide as much detail as possible, including:

• A description of the vulnerability 📝
• Steps to reproduce 🧪
• Any potential impact or risks ⚠️
• Any related logs or stack traces (if available) 📂

To ensure the security of the Network Scanner App and its users, we recommend the following best practices:

• Do not scan unauthorized networks. Ensure you have explicit permission to scan and analyze networks, as unauthorized scanning can be illegal and violate privacy and security laws. 🚫
• Limit Port Scanning: When using the port scanner functionality, limit the range of ports you scan to avoid unnecessarily large scans, which can impact network performance or trigger alarms on intrusion detection systems. 🚨

• Geolocation API Key: The ipinfo API key used in the app should be kept secure. If you're using a public version of this tool, please ensure your API key is not exposed publicly. For public deployments, use environment variables to store keys securely. 🌍

  Example:

  export IPINFO_ACCESS_TOKEN="your-secure-token"

• Keep your dependencies up to date: Regularly check for updates to dependencies such as scapy, paramiko, and tkinter to mitigate known vulnerabilities. Use a dependency management tool such as pip-tools or pipenv to ensure you use the latest versions. 🔄

• Virtual Environments: Always run the application inside a virtual environment to avoid conflicts and ensure the isolation of dependencies. 🌱

  Example:

  python -m venv env
  source env/bin/activate   # On Windows use: .\env\Scripts\activate
  pip install -r requirements.txt

• Ensure that error handling is implemented correctly to prevent the revelation of sensitive information in stack traces. Always handle exceptions gracefully and ensure no debug or sensitive information is printed to the user or logs. 🐞

• SSH (Port Scanning): If using the paramiko module for SSH or any remote connections, ensure SSH keys are used instead of passwords, and always validate the host's key to avoid man-in-the-middle attacks. 🔑
• Use SSL/TLS: For any future communication that involves user data (e.g., API calls), consider using secure communication channels like SSL/TLS to encrypt data in transit. 🔒

• Limit access to the tool: If you're deploying this tool in a shared environment, limit access to the application via access control mechanisms (e.g., restricting it to trusted IPs or using user authentication if applicable). 🔐

We expect all contributors to follow a secure coding standard and maintain a respectful, responsible attitude toward security. Please avoid making the application behave in unexpected or malicious ways that could endanger users or systems. 🙌

For more information about securing Python applications and best practices, you can explore the following resources:

• OWASP Secure Coding Practices 📖
• Python for Cybersecurity 🧑‍💻